3 stories · “remote-code-execution”.
Two CVSS 9.2 PHP flaws allow unauthenticated remote code execution. Patches shipped on 21 October 2026, but proof-of-concept code is already circulating.
WordPress 7.1.1 fixed an unauthenticated stored cross-site scripting bug in wpautop(), tracked as CVE-2026-93485, that can escalate to remote code execution.
Check Point fixed two critical certificate-handling bugs in its VPN gateways and management servers. Dutch authorities expect attackers to exploit them soon.
